在 puppet 中管理 linux 的用户密码
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/19114328/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Managing a user password for linux in puppet
提问by David Portabella
I need to create a test user with a password using puppet.
我需要使用 puppet 创建一个带有密码的测试用户。
I've read that puppet cannot manage user passwords in a generic cross-platform way, which is a pity. I am doing this for Red Hat Enterprise Linux Server release 6.3.
我读过 puppet 不能以通用的跨平台方式管理用户密码，这很遗憾。我正在为 Red Hat Enterprise Linux Server 6.3 版执行此操作。
I do as follows:
我这样做：
user { 'test_user':
ensure => present,
password => sha1('hello'),
}
puppet updates the password of the user, but Linux says login/pwd incorrect when I try to log in.
puppet 更新了用户的密码，但是当我尝试登录时，Linux 说 login/pwd 不正确。
It works (I can login) if I set the password manually in Linux with sudo passwd test_user, and then look at /etc/shadowand hardcode that value in puppet. something like:
如果我在 Linux 中使用 手动设置密码sudo passwd test_user，然后/etc/shadow在 puppet 中查看并硬编码该值，它就可以工作（我可以登录）。就像是：
user { 'test_user':
ensure => present,
password => '$zi13KdCr$zJvdWm5h552P8b34AjxO11',
}
I've tried also by adding $1$in front of the sha1('hello'),
but it does not work either (note, $1$stands for sha1).
我也尝试过$1$在 前面添加sha1('hello')，但它也不起作用（注意，$1$代表 sha1）。
How to modify the first example to make it work (using the plaintext password in the puppet file)?
如何修改第一个示例使其工作（使用 puppet 文件中的明文密码）？
P.S.: I am aware that I should use LDAP, or sshkeys, or something else, instead of hardcoding the user passwords in the puppet file. however, I am doing this only for running a puppet vagrant test, so it is ok to hardcode the user password.
PS：我知道我应该使用 LDAP、sshkeys 或其他东西，而不是在 puppet 文件中硬编码用户密码。但是，我这样做只是为了运行 puppet vagrant 测试，因此可以对用户密码进行硬编码。
采纳答案by Paul Schyska
I had success (gist)with ruby's String#crypt method from within a Puppet parser function.
我在 Puppet 解析器函数中使用 ruby 的 String#crypt 方法取得了成功（要点）。
AFAICS it's using the crypt libc functions (see: info crypt), and takes the same arguments $n$[rounds=<m>$]salt, where n is the hashing function ($6 for SHA-512) and m is the number of key strengthening rounds (5000 by default).
AFAICS 它使用 crypt libc 函数（参见：）info crypt，并采用相同的参数$n$[rounds=<m>$]salt，其中 n 是散列函数（SHA-512 为 6 美元），m 是密钥强化轮数（默认为 5000）。
回答by bryn
The sha1function in puppet is not directly intended for passwd entries, as you figured out.
I'd say setting the hash rather than the password is good practice! You are not really supposed to be able to recover a password anyway - you can generate it once, or you can have puppet generate it every time - generating that hash once should be enough IMHO...
You can generate a password on Debian/Ubuntu like this:
sha1正如您所发现的，puppet 中的函数并不直接用于 passwd 条目。我会说设置散列而不是密码是一种很好的做法！无论如何你都不应该能够恢复密码 - 你可以生成一次，或者你可以让 puppet 每次生成它 - 生成一次哈希应该足够恕我直言......你可以在 Debian/Ubuntu 上生成密码像这样：
pwgen -s -1 | mkpasswd -m sha-512 -s
...on CentOS you can use some grub-crypt command instead of mkpasswd...
...在 CentOS 上，您可以使用一些 grub-crypt 命令代替 mkpasswd ...
回答by Avinash Singh
Linux users have their passwords stored as hash in /etc/shadow file. Puppet passes the password supplied in the user type definition in the /etc/shadow file.
Linux 用户的密码以散列形式存储在 /etc/shadow 文件中。Puppet 传递 /etc/shadow 文件中用户类型定义中提供的密码。
Generate your hash password using openssl command:
使用 openssl 命令生成您的哈希密码：
#openssl passwd -1
#Enter your password here
Password:
Verifying - Password:
$HTQUGYUGYUGwsxQxCp3F/nGc4DCYM
The previous example generate this hash: $1$HTQUGYUGYUGwsxQxCp3F/nGc4DCYM/
前面的例子生成这个哈希：$1$HTQUGYUGYUGwsxQxCp3F/nGc4DCYM/
Add this hash password to your class as shown (do not forget the quotes)
如图所示将此哈希密码添加到您的课程中（不要忘记引号）
user { 'test_user':
ensure => present,
password => '$HTQUGYUGYUGwsxQxCp3F/nGc4DCYM/',
}
回答by Behrang Saeedzadeh
回答by Lyle Z
In my Vagrantfile, I did this:
在我的 Vagrantfile 中，我这样做了：
$newuserid = ENV["USERNAME"]
config.vm.provision :puppet do |puppet|
puppet.module_path = "modules"
puppet.manifests_path = "manifests"
puppet.manifest_file = "main.pp"
puppet.facter = {"newuserid" => $newuserid}
puppet.options = "--verbose"
end
And in my main.pp file:
在我的 main.pp 文件中：
user { $newuserid :
ensure => present,
home => "/home/${newuserid}",
managehome => true,
gid => "mygid",
}
exec { 'set password':
command => "/bin/echo \"${newuserid}:${newuserid}\" | /usr/sbin/chpasswd",
require => User [ $newuserid ],
}
回答by Boop
Puppet: user with a SHA 512 hashed password
Puppet：具有 SHA 512 散列密码的用户
I came up with a method that doesn't need anything to add if you have python 2.6. I tested this on puppet 3.6.2on CentOS 6.4:
如果你有 python 2.6，我想出了一个不需要添加任何东西的方法。我对此进行puppet 3.6.2了测试CentOS 6.4：
$pass="password"
$shatag="$6$"
$cmd="import crypt, base64, os, sys; sys.stdout.write(crypt.crypt('$pass', '$shatag' + base64.b64encode(os.urandom(16))[:8]))"
user { 'boop':
ensure => present,
password => generate ("/usr/bin/python", "-c", $cmd),
}
Explanations
说明
the sha tag is here to specify to
cryptthe hash method we want: 6 is the type of hash for SHA-512- $1$ -> MD5
- $2a$ -> Blowfish (not in mainline glibc; added in some Linux distributions)
- $5$ -> SHA-256 (since glibc 2.7)
- $6$ -> SHA-512 (since glibc 2.7)
sha 标签在这里指定
crypt我们想要的散列方法：6 是 SHA-512 的散列类型- $1$ -> MD5
- $2a$ -> Blowfish（不在主线 glibc 中；在一些 Linux 发行版中添加）
- $5$ -> SHA-256（自 glibc 2.7 起）
- $6$ -> SHA-512（自 glibc 2.7 起）
thx daveyand wiki_crypt
THX戴维和wiki_crypt
sys.stdout.write is hereto avoid'\n'ofprintbase64.b64encode(os.urandom(16))[:8]):os.urandom(16)create a 16 bits long binary stringbase64.b64encodeencode this string in base64[:8]take the first 8 characters of this string (as base64 encoding length may vary)
generateis a puppet function that create text when on the puppet master. You can't use this function like you want because it is 'protected' ê.é(last postsuggest a workaround to this protection-or-whatever)
sys.stdout.write is here避免'\n'的printbase64.b64encode(os.urandom(16))[:8])：os.urandom(16)创建一个 16 位长的二进制字符串base64.b64encode将此字符串编码为 base64[:8]取这个字符串的前 8 个字符（因为 base64 编码长度可能会有所不同）
generate是一个木偶功能，在木偶大师上创建文本。像你想，因为它是“保护”你不能使用此功能E.E（最后一篇建议的解决方法，这种保护有或任何）
hth
第
回答by mperrin
The stdlib package of puppetlabs implements a similar pw_hashfunction of the accepted answer.
puppetlabs 的 stdlib 包实现了与pw_hash已接受答案类似的功能。
Be sure to add the library to your configuration. If you use librarian, just add in your Puppetfile
请务必将库添加到您的配置中。如果您使用图书管理员，只需添加您的Puppetfile
mod 'puppetlabs-stdlib'
Then to create an user, simply :
然后创建一个用户，只需：
user { 'user':
ensure => present,
password => pw_hash('password', 'SHA-512', 'mysalt'),
}
回答by Creek
just generate encrypted password from grub-crypt --sha-512 and paste
只需从 grub-crypt --sha-512 生成加密密码并粘贴
